In our previous post, The ABC’s of Ishing, we broke down the foundational tactics used by cybercriminals to deceive users and gain unauthorized access. This follow-up report expands on that foundation by exploring three evolving phishing threats that go beyond traditional email lures.
Angler Phishing, Calendar Phishing, and Captcha Phishing each exploit trust in everyday digital tools—social media platforms, calendar invites, and CAPTCHA challenges. According to Bitsight Threat Research, these methods are growing in both sophistication and frequency, placing organizations at increased risk.
Angler Phishing involves fraudsters creating fake customer support profiles on platforms like Facebook, Instagram, and Twitter. They closely mimic legitimate accounts, responding to user inquiries—especially from frustrated customers—to steal credentials or deliver malware.
An attack campaign impersonated a major online payment provider’s X (formerly Twitter) support account. Fraudsters monitored posts tagging the real support handle. When users reached out, these fake accounts replied with branded login links. After clicking, victims were redirected to a convincing login prompt that captured their credentials.
These attacks lead to account takeovers, data theft, reputational harm, and potential business disruption.
Report fake accounts promptly to social media platforms. According to Bitsight Threat Research, increased phishing chatter on social media often precedes broader targeting campaigns.
Calendar Phishing exploits platforms like Google Calendar, embedding malicious links into invites to bypass email filters and deceive users into clicking without scrutiny.
According to Bitsight Threat Intelligence, over a period of four weeks more than 4,000 spoofed invites hit approximately 300 organizations. These invites appeared as legitimate meeting requests, often redirecting users to phishing pages disguised as Google Forms or Drawings. A media advisory also flagged similar campaigns using misleading diary entries to lure users.
This method enables credential harvesting, malware deployment, and unauthorized access to corporate systems.
Captcha Phishing involves tricking users into executing malicious commands under the guise of a CAPTCHA challenge. These fake CAPTCHAs can exploit human trust in verification processes for malware delivery.
Fake CAPTCHAs have been embedded into seemingly harmless websites or ads. Clicking “I’m not a robot” tricks users into copying a command which they then paste and run via the Windows Run dialog box—installing malware like Lumma Stealer.
Lumma Stealer has been linked to these tactics. It steals data from browsers and crypto wallets, using CAPTCHA-triggered execution to gain access and evade detection.
This attack circumvents standard security checks, resulting in data breaches, malware infiltration, and system compromise.
Angler Phishing, Calendar Phishing, and Captcha Phishing each exploit common user behaviors and digital tools. According to Bitsight Threat Research, the convergence of human trust with modern phishing techniques makes these methods both effective and difficult to detect. Senior leadership should invest in awareness, automation, layered security, and rapid response to stay ahead of these evolving cyber threats. Learn more about how Bitsight Cyber Threat Intelligence can help.
The attack surface is expanding as AI becomes more embedded in enterprise and attacker workflows. Get the full picture on AI exposure, exploit pressure, and the underground trends security teams need to watch.
